WSA Warsaw - II SA/Wa 1899/20
From GDPRhub
| WSA Warsaw - II SA/Wa 1899/20 | |
|---|---|
 | |
| Court: | WSA Warsaw (Poland) |
| Jurisdiction: | Poland |
| Relevant Law: | Article 5(2) GDPR Article 6(1)(a) GDPR Article 6(1)(b) GDPR Article 17 GDPR Article 58(2)(g) GDPR |
| Decided: | 23.03.2021 |
| Published: | |
| Parties: | |
| National Case Number/Name: | II SA/Wa 1899/20 |
| European Case Law Identifier: | |
| Appeal from: | |
| Appeal to: | |
| Original Language(s): | Polish |
| Original Source: | Centralna Baza Sądów Administracyjnych (in Polish) |
| Initial Contributor: | Agnieszka Rapcewicz |
The Provincial Administrative Court in Warsaw held that the supervisory authority is obliged to explain in its decision why it believes the statements of the one party and refuses to believe the statements of the other party. In particular the DPA should calrify what conclusions it draws from documents and explanations of the parties. Without such a clarification a decision refusing to grant the complainant's request should be regarded as premature.
English Summary
Facts
The data subject filed a complaint with the supervisory authority about the unlawful processing of her personal data, in particular her image, by a sole proprietor (the Controller).
The complainant stated that she had been invited by the Controller to take part in a music video which he was to produce. The complainant gave her written consent to the free processing of her personal data, including the use of her image by the Controller. The unpaid consent to data processing in question covered the use of the complainant's personal data, i.e. her image, in connection with the production of a music video by the band [...], made for the song "[...]", which was subsequently published on the [...] portal. The complainant emphasised that she did not enter into a contract with the Controller covering her participation in the clip, nor did she receive any remuneration for appearing in the clip or for the use of her image. The complainant explained that, after her performance, she received the sum of PLN 150 as reimbursement of costs associated with the preparation for the music video and travel to the shooting set. This amount was also compensation for the time spent by the complainant on, among other things, studying the script of the music video. The Controller published the abovementioned music video on his recording studio's profile on the website [...], also making available there the complainant's personal data in the form of her first and last name. The Controller also published on the [...] and Instagram portals a photographic material with the image of the complainant, making available there also her personal data in the form of her first and last name, as well as another film material using the image of the complainant ([...]). The photographic material using the image of the applicant and her name and surname data was also made available by the applicant to other commercial portals. In January 2019 the complainant withdrew her consent to the processing of her personal data by the Controller. The complainant at that time requested the Controller to delete her personal data and to cease processing it. Despite the withdrawal of consents, the Controller used the complainant's image by publishing footage promoting the complainant's activities on portals. The complainant repeatedly requested the Controller in writing to delete her personal data and to refrain from infringing her personal rights. The complainant requested that the President of the Office for Personal Data Protection order the Controller to permanently remove her personal data, including her image, from any media and places where they were used or made available, and in particular to remove those parts of the video clip of the band [...], performed for the song '[...]', which contain her personal data in the form of her image.
The Controller claimed that he he processed the complainant's personal data on the basis of a contract.
The President of the Office for Personal Data Protection refused to grant the complainant's request. Therefore she filed a complaint with the Provincial Administrative Court in Warsaw.
Dispute
Holding
The Court annulled the contested decision of the President of the Office for Personal Data Protection nad found that the authority did not meet its obligation to explain precisely the reasons why it took the view that the parties were bound by an agreement the subject of which was the complainant's appearance in a music video produced by the Controller. The Court held that there is no certainty as to the correctness of the established facts, so the conclusions of the body concerning the legitimacy of the complaint initiating the proceedings appeared to be premature.
Comment
The supervisory authority considered that the complainant's personal data were obtained by the Controller t in connection with the conclusion by the parties of a contract the subject of which was the complainant's appearance in a music video produced by the Controller for a musical work by the band [...].
The authority stated that in the case in question, the disputed elements of the abovementioned agreement concern, among others, the issue of its payment. It indicated that the President of the Office for Personal Data Protection is not competent to resolve issues related to the correct (or incorrect) performance of agreements concluded between the parties in business trade, termination of such agreements or verification of the manner of mutual provision of services. It is also not within the competence of the authority to determine whether the contract concluded by the parties to the proceedings was payable, if this is a disputed circumstance. Such matters, pursuant to Article 1 of the Act of 17 November 1964 Code of Civil Procedure (Journal of Laws of 2019, item 1460), are civil matters and should be dealt with in proceedings conducted by common courts.
The President of the Office for Personl Data Protecrtion stated that in connection with the fact that the parties to the proceedings in question concluded an agreement the subject matter of which was the Complainant's appearance in the music video for the band [...] produced by the Complainant, the processing of the Complainant's personal data by the Complainant fulfils the premise of Article 6(1)(b) of Regulation 2016/679.
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.
SENTENCE The Wojewódzki Sąd Administracyjny w Warszawie, in the following composition: Presiding Judge of the Voivodship Administrative Court Łukasz Krzycki, Judge of the Voivodship Administrative Court Janusz Walawski, Judge of the Voivodship Administrative Court Andrzej Góraj (spr.), having examined, under a simplified procedure on 23 March 2021, a case concerning a complaint filed by M. S. against the decision of the President of the Office for Personal Data Protection of [...] July 2020 No. [...] on the processing of personal data 1. annuls the appealed decision; 2. awards the President of the Office for Personal Data Protection the amount of PLN 680 (six hundred and eighty) in favour of M. S. as reimbursement of the costs of the proceedings. STATEMENT OF REASONS The Office for Personal Data Protection received on 20 May 2019 a complaint from M. S., hereinafter referred to as "the complainant", about the unlawful processing of her personal data, in particular her image, by J. S. conducting business under the name [...] J. S. hereinafter 'the applicant'. In the wording of her complaint, the applicant stated that she had been invited by J. S. to take part in a music video which he was to produce. On [...] October 2018, the applicant gave her written consent to the free processing of her personal data, including the use of her image by the complainant. The unpaid consent to data processing in question covered the complainant's use of the applicant's personal data, i.e. her image, in connection with the production of a music video by the band [...], made for the song "[...]", which was subsequently published on the [...] portal. The applicant emphasised that she did not enter into a contract with the applicant covering her participation in the clip, nor did she receive any remuneration for appearing in the clip or for the use of her image. The applicant explained that, after her performance, she received the sum of PLN 150 as reimbursement of costs associated with the preparation for the music video and travel to the shooting set. This amount was also compensation for the time spent by the applicant on, among other things, studying the script of the music video. The applicant published the abovementioned music video on his recording studio's profile on the website [...], also making available there the applicant's personal data in the form of her first and last name. The complainant also published on the [...] and Instagram portals a photographic material with the image of the complainant, making available there also her personal data in the form of her first and last name, as well as another film material using the image of the complainant ([...]). The photographic material using the image of the applicant and her name and surname data was also made available by the applicant to other commercial portals, such as [...].pl. On [...] January 2019. The Applicant withdrew her consent to the processing of her personal data by the Complainant. The Complainant at that time requested the Complainant to delete her personal data and to cease processing it. Despite the withdrawal of consents, the complainant on 18 January 2019 used the complainant's image by publishing footage promoting the complainant's activities on the [...] and [...] portals. The applicant repeatedly requested the complainant in writing to delete her personal data and to desist from infringing her personal rights. The applicant requested that the President of the Office for Personal Data Protection order the respondent to permanently remove her personal data, including her image, from any media and places where they were used, disseminated or otherwise made available, and in particular to remove those parts of the video clip of the band [...], performed for the song '[...]', which contain her personal data in the form of her image. In the course of the proceedings conducted in the present case, the President of the Office for Personal Data Protection established the following factual situation: The complainant indicated that the basis for the processing of the complainant's personal data was a contract concluded on [...] October 2018 between it and the complainant, the subject of which was the paid appearance of the complainant in a music video for a musical work by the band [...], which was being produced by the complainant. The complainant explained that "the applicant had knowledge from the outset of the purpose of the recording, the form of dissemination of the work (music video), and she herself set the proposed rate for the performance at PLN 150" . Materials promoting the applicant's activity with the use of the above video clip were removed from the applicant's website and company profile. The complainant's personal data is held by the complainant in the archives of his company in the form of a file on a hard drive. The complainant has informed of the complainant's withdrawal of consent from the purchasers of the song, i.e. the members of the band [...], who consider that they are not a party to this dispute. The music video can be found on the channel of the band [...] on the [...] website and this is the only place where the image of the Complainant is currently found. The President of the Office for Personal Data Protection, by decision of [...] July 2020 No. [...], acting pursuant to Article 104 § 1 of the Act of 14 June 1960 Code of Administrative Procedure (Journal of Laws of 2020, item 256, i.e.) in connection with Article 7 (1) of the Act on the Protection of Personal Data of 10 May 2018 (Journal of Laws of 2019, item 1781) and Article 6 (1) (b) of Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016. on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119 of 04.05.2016, p. 1 and Official Journal of the European Union L 127 of 23.05.2018, p. 2 as amended), having conducted an administrative proceeding concerning a complaint filed by M. S., on the unlawful processing of her personal data, in particular her image, by J. S. conducting business activity under the firm [...] J. S. refused to grant the request. The authority indicated that, pursuant to Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Official Journal of the European Union L 119 of 04.05.2016, p. 1 and OJ L 127 of 23.05.2018, p. 2.), hereinafter referred to as "Regulation 2016/679", in order for the processing of personal data to be lawful, the controller is obliged to process personal data on the grounds set out in Article 6 of Regulation 2016/679. The aforementioned provision stipulates that the processing is lawful, inter alia, when: processing is necessary for the performance of a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b)). Taking into account the above, the President of the Office for Personal Data Protection indicated that the parties to the proceedings had made appropriate arrangements with regard to the shooting of the music video of the band [...]. The applicant knowingly participated in the music video produced by the complainant, was informed about the purpose of the recording, the forms of distribution of the music video, familiarised herself with the scenario of the music video, and made appropriate preparations to appear in the above-mentioned music video. In the case file there is a statement by members of the band [...], in which members of the band confirm that the applicant knew and accepted, among other things, the purpose of the recording of the music video and the manner of its distribution. The body thus considered that the complainant's personal data were obtained by the complainant in connection with the conclusion by the parties to these proceedings of a contract the subject of which was the complainant's appearance in a music video produced by the complainant for a musical work by the band [...]. The authority stated that in the case in question, the disputed elements of the abovementioned agreement concern, among others, the issue of its payment. It indicated that the President of the Office for Personal Data Protection is not competent to resolve issues related to the correct (or incorrect) performance of agreements concluded between the parties in business trade, termination of such agreements or verification of the manner of mutual provision of services. It is also not within the competence of the authority to determine whether the contract concluded by the parties to the proceedings was payable, if this is a disputed circumstance. Such matters, pursuant to Article 1 of the Act of 17 November 1964 Code of Civil Procedure (Journal of Laws of 2019, item 1460), are civil matters and should be dealt with in proceedings conducted by common courts. The music video in which the Complainant performed is available on [...] on the band's channel [...]. The Complainant removed materials promoting the Complainant's activities using the above-mentioned music video from the Complainant's website and company profile. Currently, the Complainant's personal data are held by the Complainant in the archives of his company in the form of a file on his hard drive. The President of the Office for Personl Data Protection stated that in connection with the fact that the parties to the proceedings in question concluded an agreement the subject matter of which was the Complainant's appearance in the music video for the band [...] produced by the Complainant, the processing of the Complainant's personal data by the Complainant fulfils the premise of Article 6(1)(b) of Regulation 2016/679. In the light of the above, in the opinion of the President of the Office for Personal Data Protection, there are no grounds for applying the provision of Article 58(2) of Regulation 2016/679. The factual and legal findings made in the case demonstrated that the processing of the applicant's personal data by the applicant is carried out in accordance with the provisions of Regulation 2016/679. The decision of the President of the Office for Personal Data Protection became the subject of a complaint by M. S., represented by an attorney, to the Voivodship Administrative Court in Warsaw. Pursuant to Article 57(1)(3) p.p.s.a., she alleged that the contested decision: 1. infringement of substantive law influencing the outcome of the case, i.e: (a) breach of Article 6(1)(a) in conjunction with Article 5(2) of the RODO by failing to apply it and finding, contrary to the evidence presented by the Applicant, that the basis for the processing of her personal data was an alleged contract and was justified under Article 6(1)(b) of the RODO, whereas the controller had not presented such a contract; (b) breach of Article 6(1)(a) in conjunction with Articles [...](1) and (2) and 5(2) of the RODO by reason of its non-application and of the finding by the authority that the applicant was aware of the scope, purpose and legal basis of the processing of her personal data and of her right to withdraw consent at any time; (c) breach of Article 17(1) and (2), in conjunction with Article 58(2)(g), of the DPA, by failing to apply them and omitting the obligation on the controller to delete the applicant's personal data without undue delay, since the applicant has withdrawn the consent on which on which the processing is based pursuant to Article 6(1)(a); d) breach of Article 6(1)(b) of RODO in conjunction with Article 81 of PrA by its erroneous application and recognition that the consent to use the image referred to in Art. 81 PrAJ is the same as the consent to process personal data including image, referred to in art. 6(1)(a) RODO, which implies the existence of a contract constituting the basis for processing the Applicant's personal data; 2. infringement of the provisions of administrative procedure which could have had a significant impact on the outcome of the case, i.e: (a) Breach of Article 77(1) of the Code of Administrative Procedure, read in conjunction with Article 5(2) of the RODO, by failing to apply them and relying solely on the explanations of the Administrator, whereas the Administrator, in accordance with the principle of accountability, is obliged to demonstrate compliance with the principles referred to in Article 5(1) of the RODO and Article 6(1) of the RODO; b) breach of Article 77(1) of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure) in connection with Article 80 of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure) and Article 7 of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure) by their non-application, by failing to take into account evidence and arguments supporting the applicant's position, by failing to properly and comprehensively explain the case and by failing to consider all the evidence, as well as by arbitrary and selective assessment of evidence collected in the case; c) breach of Article 7(1) of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure) by failure to apply it, i.e. failure to take all necessary steps to clarify the facts of the case thoroughly. necessary for the precise clarification of the facts; d) breach of Article 10(1) of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure), in connection with Article 79a(1) of Kodeks Postępowania Aywilnego (the Code of Administrative Procedure), by failing to ensure active participation by the applicant as a party in the procedure, including by failing to notify the applicant of the Body's intention to issue a negative decision and, as a consequence, by failing to give the applicant the opportunity to supplement the evidence or take a position before the decision was issued, in the absence of any premises for departing from that principle; In the light of the above pleas, the applicant requests that 1. annul the decision in its entirety pursuant to Article 145(1)(1)(a) and (c) p.p.s.a; 2. the PUODO be obliged to issue a decision ordering the controller to cease processing the applicant's personal data pursuant to Article 145a(1) p.p.s.a; 3. the examination of the case under a simplified procedure pursuant to Article 119(2) p.p.s.a; admission of evidence indicated in the statement of reasons; 4. reimbursement of the costs of the proceedings necessary for the purposes of vindicating rights, pursuant to Article 200 of p.p.s.a. in conjunction with Article 205(2) of p.p.s.a. In his reply to the complaint, the President of the Office for Personal Data Protection requested dismissal of the complaint, sustaining the arguments included in the appealed decision. The Voivodship Administrative Court in Warsaw stated as follows: Pursuant to the provisions of Article 1 § 1 and 2 of the Act of 25 July 2002. - Law on the Administrative Court System (Journal of Laws of 2019, item 2167, as amended), the Administrative Court exercises the administration of justice by reviewing, in terms of lawfulness, the administrative decision appealed against. Thus, it is a control of the legality of the decision made in administrative proceedings, from the point of view of its compliance with substantive and procedural law. Assessing the decision in question according to the above criteria, it should be concluded that it should be eliminated from legal circulation as defective. The essence of the case in these proceedings boiled down to the assessment whether the authority properly justified its decision. Pursuant to Article 107 § 1 of the Code of Administrative Procedure, a decision should include: designation of a public administration body, the date of issuance, designation of a party or parties, reference to the legal basis, resolution, factual and legal justification, instruction as to whether and in what manner an appeal may be filed against it, signature stating the forename and surname and official position of a person authorized to issue the decision. A decision in relation to which an action may be brought before a common court or a complaint before an administrative court should also contain an instruction on the admissibility of bringing an action or a complaint. Paragraph 3 of the abovementioned provision specifies, however, what the justification for the decision should look like. It should, in particular, contain an indication of the facts which the authority found to be proven, the evidence on which it based its decision and the reasons why it denied the credibility and evidentiary value of other evidence. The body justifying the issued decision should therefore first of all refer to the evidence gathered in the course of the administrative proceedings. This refers both to the evidence on which it based its decision, as well as the evidence which it refused to believe. After presenting the evidence gathered and explaining which of it was believed and which was disbelieved and why, the body issuing the decision is obliged to establish the facts constituting the essence of the examined case. At the final stage of the statement of reasons, the authority should present its conclusions after examining all the evidence gathered in the case. Only a properly drafted statement of reasons allows the party to the proceedings to learn the motives behind the authority's actions and understand the decision issued. Thanks to properly prepared justification, also the court, in the case of filing a complaint, has a possibility to verify the issued decision and examine whether the authority took into account all evidence gathered in the case, and whether it explained its position in a logical manner. Taking into account the subject matter of the case, the key issue for the decision was to assess how the authority justified the existence of the legalizing premise described in Article 6 of RODO. As it follows from the wording of the statement of reasons of the decision, the authority considered as the above premise the agreement concluded [...] October 2018. between the applicant and the complainant. Indeed, this is the circumstance referred to in the part of the grounds of the decision covering the findings of fact. Those findings were confirmed by the authority in the further part of the statement of reasons by the statement that 'the applicant's personal data were obtained by the applicant in connection with the conclusion by the parties to these proceedings of a contract the subject of which was the applicant's appearance in a music video produced by the applicant'. If, therefore, the authority based its entire decision on the assumption that the parties to the proceedings had concluded a contract, it should have clarified the issue. The need for the authority to clarify its claims was all the more necessary as the applicant firmly denied the existence of such an agreement. Analysis of the contested decision leads to the conclusion that the authority did not meet its obligation to explain precisely the reasons why it took the view that the parties were bound by an agreement the subject of which was the applicant's appearance in a music video produced by the applicant. First of all, the authority did not explain in the grounds for its decision in what form the contested agreement had been concluded. This is of great significance for the correctness of the proceedings for the taking of evidence, because if the parties concluded the agreement in writing, the authority was obliged to include such an agreement in the evidence in the case. If, on the other hand, the authority was convinced that the agreement between the parties was oral, it should determine what the essential elements of that agreement were. It should do so from the point of view of the consent of the parties to the agreement in question. Further, the authority would have to explain in great detail the reasons why it considered that the parties had nevertheless concluded a contract (the existence of which the applicant denied). To this end, the authority would have to cite all the evidence from which it concluded that there was an agreement between the parties. It should also present its analysis of that evidence, explaining why it believed some of it and refused to credit others. In the facts of the case, in a situation where, on [...] October 2018 the applicant gave written consent to the use of her image, the authority should also assess this document. It should clarify whether it treats it as part of the parties' agreement or whether it is this document that it considers to be the actual agreement between the parties. However, the above result of the authority's actions is not to be found in the grounds of the contested decision. All that can be inferred from it is that the authority deduced the finding that there was an agreement between the parties from the applicant's statement and the statements of the members of the [...] team. However, the authority did not explain in a single sentence why it believed those statements and refused to believe the applicant's allegations that there was no contract with the applicant. Since it did not set out in the grounds of its decision its reasoning and inferences for establishing the facts, it thereby deprived the Tribunal of the possibility of verifying the correctness of its reasoning. The role of the administrative court is not to find out why the body assessed evidence in a particular manner. Nor is it its role to replace the body in the above actions. The abovementioned faults of the authority in making the findings of fact make it impossible to know whether it correctly determined the facts that are crucial to the case. Since there is no certainty as to the correctness of the established facts, the conclusions of the body concerning the legitimacy of the complaint initiating the proceedings appear to be premature. In view of the above, recognising that the appealed decision violates the law, the Voivodship Administrative Court in Warsaw ruled as set forth in point 1 of the judgment pursuant to Article 145 § 1 of the Act on Administrative Law. 1 of the judgment pursuant to Article 145 § 1 item. 1c of the Act of 30 August 2002. - The Provincial Administrative Court in Warsaw ruled as provided for in point 1 of the judgment pursuant to Article 145(1)(1c) of the Act of 30 August 2002 - the Law on Administrative Court Proceedings (Journal of Laws of 2019, item 2325, as amended), and decided on costs pursuant to Article 200 of the abovementioned Act, awarding the costs incurred by the appellant for the payment of the court fee on the complaint and the remuneration of the professional representative to the body. When re-examining the case, the authority will be obliged to take account of the observations of the Court of First Instance in order to establish the facts of the case in a comprehensive manner, presenting in the grounds for its decision the matter of the thought process concerning the analysis of the evidence gathered in the case.
